Filter Driver Unloaded Via Fltmc.EXE
This rule detects attempts to unload filter drivers using the 'fltmc.exe' utility. Adversaries may unload filter drivers, which are often used by security products (like EDRs or antivirus), to impair defenses and evade detection. The rule specifically looks for 'fltmc.exe' being executed with the 'unload' command-line argument. It includes filters for known legitimate activities from Avira and ManageEngine to reduce false positives.
Sigma
